CVE-2026-1002

CVE-2026-1002 is a medium-severity vulnerability affecting the Vert.x Web static handler component, allowing attackers to deny access to static files. By crafting a specific URI, an attacker can manipulate the static handler's cache, leading to a denial of service (HTTP 404) for legitimate users. This issue stems from an improper implementation of RFC3986 section 5.2.4 and is remediated by updating the Vert.x Core component or disabling the static handler cache. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required, resulting in a low impact on availability. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion or media coverage has been observed.